[Forgot Password]
Login  Register Subscribe

30481

 
 

423868

 
 

255116

 
 

909

 
 

198683

 
 

282

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2024-4896Date: (C)2024-05-22   (M)2024-05-24


The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ���url��� parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 6.4CVSS Score :
Exploit Score: 3.1Exploit Score:
Impact Score: 2.7Impact Score:
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector:
Attack Complexity: LOWAccess Complexity:
Privileges Required: LOWAuthentication:
User Interaction: NONEConfidentiality:
Scope: CHANGEDIntegrity:
Confidentiality: LOWAvailability:
Integrity: LOW 
Availability: NONE 
  
Reference:
https://plugins.trac.wordpress.org/browser/wpb-elementor-addons/trunk/templates/videos_grid.php#L323
https://plugins.trac.wordpress.org/changeset/3088737/#file26
https://www.wordfence.com/threat-intel/vulnerabilities/id/103dea33-0c30-460e-80e4-fead18928a62?source=cve

© SecPod Technologies